Privacy Policy
Nasida Apps LLC ("we", "us") operates PostDelegate. This policy explains the personal data we handle through the service and the choices available to you.
1. Data we collect
| Category | What it includes and why |
|---|---|
| Account data | Email address, a Google account identifier when you choose Google sign-in, profile details you provide, organization membership and role, and a password hash for a local password account. This supports sign-in and account access. |
| Content | Drafts, posts, scheduling details, uploaded media and related records that you or your team submit to the service. |
| Connected accounts | If a social connection is separately enabled and authorized, its account identifiers, connection credentials and data needed for the features you request. Google sign-in alone does not connect a publishing channel. |
| Technical data | IP address, browser information, request metadata and operational or security logs generated when the application, media host or Cloudflare edge handles a request. |
| Communications | Information you send when contacting support. |
2. How we use data
We use account information to authenticate you, manage access and provide support. We process submitted content to store, display and manage it, and to carry out publishing instructions when the relevant channel is configured and authorized. We use technical data to operate, secure and troubleshoot the service. We do not sell personal data or use it for advertising.
Where the GDPR or UK GDPR applies, we rely on contract for providing the service, legitimate interests for proportionate security and reliability work, legal obligations where applicable, and consent where requested.
3. Google sign-in and YouTube connections
Google sign-in requests access to your basic profile and email address. We use your Google account identifier and email address to identify or create your PostDelegate account. Google authorization credentials are exchanged during sign-in so we can obtain that information; PostDelegate then issues its own application session.
These sign-in permissions do not authorize access to your Gmail messages, Drive files, Calendar events or YouTube channel content, and do not authorize posting to a social channel. Any publishing connection requires its own permissions and configuration.
PostDelegate uses YouTube API Services when you separately connect a YouTube channel. With your authorization, we access your Google profile and email address, channel identifiers, names and images, video identifiers and statistics, and channel analytics. We use this information to identify your channel, upload the videos and optional thumbnails you instruct us to publish, record publishing results and display performance.
We store OAuth access and refresh tokens to maintain your YouTube connection, together with channel details and publishing records in our application database. YouTube channel and video analytics reports are fetched on demand. Earlier server-side analytics cache entries may remain for up to one hour. Publishing sends your selected video, title, description, optional thumbnail and publishing settings to Google/YouTube. Connected-channel information and reports are available to authorized workspace members according to their access permissions.
We use Google and YouTube data only for the sign-in and separately authorized YouTube features described here, account access, support and security. We do not sell this data, use it for advertising or use it to train generalized AI models. Our handling of Google data must follow the Google API Services User Data Policy, including applicable Limited Use requirements. Google's own processing is described in the Google Privacy Policy.
You can revoke PostDelegate's access through Google's security settings. You can also request deletion of data held by PostDelegate, or contact us about our privacy practices, by emailing support@postdelegate.com, as described in Retention and deletion below. Deleting PostDelegate's records does not delete videos or other data held by YouTube; manage that data through YouTube or YouTube Studio.
4. Hosting and other recipients
- OVHcloud: hosts the application server and its databases.
- Cloudflare: DNS, proxy/CDN and security services handle request metadata; R2 stores uploaded media.
- Google/YouTube: provides optional Google sign-in and, when separately authorized, YouTube channel access, video and thumbnail uploads, and analytics through YouTube API Services.
- Your authorized recipients: workspace members according to access permissions, and any separately configured social platform to which you instruct the service to publish.
AI generation, outbound transactional email and payment/billing integrations are not currently active.
We may also disclose information when required by law or to protect rights and safety. Any ownership transfer remains subject to this policy and applicable law.
5. Uploaded media is publicly retrievable
Our media host, media.postdelegate.com, serves uploaded objects through public HTTPS URLs without application sign-in. Anyone who obtains a media URL can retrieve that object. Upload only material that may be publicly accessible. Removing an application record does not necessarily remove the stored object or every cached copy.
6. Cookies and browser storage
The application uses cookies and browser storage for sign-in, organization selection, language and display preferences, timezone settings and authentication flows. Cloudflare may use security-related mechanisms when handling requests.
When an embedded YouTube player is loaded in the service, your browser contacts Google/YouTube, which may receive device and request information and use cookies or similar technologies under the Google Privacy Policy.
7. Retention and deletion
We retain account information and submitted content as needed to provide the service. Data may also be held in uploaded media, operational logs and recovery backups, including recovery copies retained from an earlier version of the service.
To request access, correction, export or deletion, email support@postdelegate.com. We may need to verify your identity and clarify which account or workspace the request concerns. Legal requirements, security needs, recovery copies and the rights of other people or workspace members may affect what can be removed and when. We will explain applicable retention and report the request's completion status. A deletion request does not automatically erase every live, cached or recovery copy.
8. Security
The public application and media host use HTTPS. Application databases and supporting services are not exposed through public database ports, and local account passwords are hashed. No system is perfectly secure; report suspected vulnerabilities to support@postdelegate.com.
9. International processing and your rights
OVHcloud and Cloudflare may process data through server, storage and edge facilities in different countries. Those countries' data-protection laws may differ from those where you live.
Depending on your location and applicable law, you may have rights to access, correct, delete or export your data, restrict or object to processing, withdraw consent, or complain to a data protection authority. Contact the support address above. If your data was submitted through another customer's workspace, identify that customer so the request can be directed appropriately.
10. Children
PostDelegate is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
11. Changes and contact
We may update this policy and will post the new version with a new effective date. Material changes will be communicated through the service or another available contact method.
Nasida Apps LLC
support@postdelegate.com
Related document: Terms of Service.